A Plaintext-checking Oracle for Decapsulation Leakage in the NIST HQC FPGA Reference Implementation

Sammanfattning

In this thesis, we evaluate the side-channel security of the NIST HQC post-quantum cryptosystem by analysing the official FPGA decapsulation implementation. A hardware wrapper was created to interact with the HQC decapsulation modules, enabling ciphertext decapsulation with precise power trace capturing using a ChipWhisperer CW305 and Husky setup. A dataset with 20k power traces was generated from decapsulating two different ciphertext groups, having $m=0$ and $m=rand()$. Statistical leakage assessment revealed significant leakage about the message in both the SHAKE pseudorandom number generator and the decoder used in the HQC decoding stage. A few machine-learning models were trained and evaluated on their distinguishing capabilities of determining the group of the message decapsulated from a single power trace. The best-performing model, a small convolutional neural network, achieved a validation accuracy of $97.2\%$. Using this oracle accuracy, a key-recovery simulation was performed, which showed that approximately 736 decapsulation traces were enough to recover the secret-key with a probability of $72.3\%$. These results demonstrated that the 2021 NIST HQC FPGA implementation contains exploitable side-channel leakage and that both the SHAKE part and the decoding part require stronger countermeasures.